KYŪDŌ AI-GRC PLATFORM AGREEMENT
Standard Contract for Microsoft's Commercial Marketplace, as Amended by Publisher's Universal Amendment - Kyudo, Inc.
This Agreement ("Agreement") is between you ("you" or "Customer") and Kyudo, Inc., a California corporation ("Publisher" or "Provider"), and governs your use of the Kyūdō AI-GRC Platform offered as an Azure Managed Application (the "Offering" or "Platform") purchased through Microsoft Marketplace ("Marketplace").
This Agreement consists of the Standard Contract for Microsoft's commercial marketplace as amended by Publisher's Universal Amendment, the terms of which are consolidated herein. This Agreement is the parties' entire agreement on this subject and merges and supersedes all related prior and contemporaneous agreements. By agreeing to these terms, you represent and warrant that you have the authority to accept this Agreement, and you agree to be bound by its terms. This Agreement applies to all Orders entered into under this Agreement. Capitalized terms have the meanings given under "Definitions."
Microsoft has created the template Standard Contract to facilitate a transaction between Publisher and Customer. Both parties acknowledge that Microsoft is not a party to this Agreement, nor in any way responsible for the parties' actions or obligations under this Agreement. Microsoft's relationship with Customer and Publisher is solely governed by Microsoft's respective agreements with those parties; Microsoft otherwise disclaims all liability resulting from this Agreement (including any Orders). This Agreement does not modify any agreement between Customer and Microsoft, including the Microsoft Customer Agreement governing Customer's Azure subscription.
In the event of conflict, the order of precedence is: (a) a mutually executed Order Form, private offer, or separately negotiated agreement between Publisher and Customer, if any; (b) the provisions of this Agreement originating in Publisher's Universal Amendment; (c) the remaining provisions of this Agreement; (d) the Service Level Agreement (SLA), if any; (e) the Documentation; and (f) the Offer listing description.

LICENSE TO OFFERINGS

1.1 License grant. Offerings are licensed and not sold. Upon acceptance of an Order, and subject to Customer's compliance with this Agreement, Publisher grants Customer a nonexclusive and limited license to use the ordered Offerings. These licenses are solely for Customer's own use and business purposes and are nontransferable except as expressly permitted under this Agreement or applicable law. The license to the Platform is limited to Customer's internal governance, risk, and compliance operations, in accordance with the Documentation and the applicable Order, and is subject to the user counts, framework counts, and other limits specified in the Order.
Offerings contain or are provided with components that are subject to open-source software licenses, as further described in Section 12 (Intellectual Property and Third-Party Components). Any use of those components may be subject to additional terms and conditions, and Customer agrees that any applicable licenses governing the use of the components are incorporated by reference in this Agreement.
1.2 Duration of licenses. Licenses granted on a subscription basis expire at the end of the applicable subscription period set forth in the Order, unless renewed in accordance with Section 9.2. Licenses granted for metered Offerings billed periodically based on usage continue as long as Customer continues to pay for its usage of the Offerings. All other licenses become perpetual upon payment in full.
1.3 End Users. Customer will control access to and use of the Offerings by End Users and is responsible for any use of the Offerings that does not comply with this Agreement.
1.4 Affiliates. Customer may order Offerings for use by its Affiliates. If it does, the licenses granted to Customer under this Agreement will apply to such Affiliates, but Customer will have the sole right to enforce this Agreement against Publisher. Customer will remain responsible for all obligations under this Agreement and for its Affiliates' compliance with this Agreement and any applicable Order(s).
1.5 Reservation of Rights. Publisher reserves all rights not expressly granted in this Agreement. Offerings are protected by copyright and other intellectual property laws and international treaties. No rights will be granted or implied by waiver or estoppel. Rights to access or use Offerings on a device do not give Customer any right to implement Publisher's patents or other intellectual property in the device itself or in any other software or devices.
1.6 Restrictions. Except as expressly permitted in this Agreement, Documentation or an Order, Customer must not, and must not permit any Authorized User or third party to (and is not licensed to):
a. copy, modify, translate, adapt, reverse engineer, decompile, or disassemble any Offering, create derivative works based on the Offering, or attempt to derive the source code or underlying algorithms of the Platform, or attempt to do any of the foregoing;
b. install or use any third-party software or technology in any way that would subject Publisher's intellectual property or technology to any other license terms;
c. work around or circumvent any technical limitations in an Offering, restrictions in Documentation, or any security or licensing feature of the Platform;
d. separate and run parts of an Offering on more than one device;
e. upgrade or downgrade parts of an Offering at different times;
f. use an Offering for any unlawful purpose, including to store, transmit, or process data in violation of applicable law, including data subject to ITAR, EAR, or HIPAA where the applicable deployment option has not been configured for that regulatory environment;
g. transfer parts of an Offering separately;
h. distribute, sublicense, rent, lease, or lend any Offerings, in whole or in part, or use them to offer hosting services to a third party;
i. access the Platform for the purpose of building a competitive product or service, or copy any features, functions, or interface of the Platform for competitive purposes;
j. remove or alter any proprietary notices, labels, or marks on the Platform or Documentation; or
k. introduce malicious code into the Customer Tenant or any integrated system through use of the Platform.
1.7 License transfers. Customer may only transfer fully-paid, perpetual licenses to (1) an Affiliate or (2) a third party solely in connection with the transfer of hardware to which, or employees to whom, the licenses have been assigned as part of (A) a divestiture of all or part of an Affiliate or (B) a merger involving Customer or an Affiliate. Upon such transfer, Customer must uninstall and discontinue using the licensed Offering and render any copies unusable. Customer must notify Publisher of a license transfer and provide the transferee a copy of this Agreement and any other documents necessary to show the scope, purpose, and limitations of the licenses transferred. Attempted license transfers that do not comply with this section are void.
1.8 Feedback. Any Feedback is given voluntarily, and the provider grants to the recipient, without charge, a non-exclusive license under provider's owned or controlled non-patent intellectual property rights to make, use, modify, distribute, and commercialize the Feedback as part of any of recipient's products and services, in whole or in part and without regard to whether such Feedback is marked or otherwise designated by the provider as confidential. The provider retains all other rights in any Feedback and limits the rights granted under this section to licenses under its owned or controlled non-patent intellectual property rights in the Feedback (which do not extend to any technologies that may be necessary to make or use any product or service that incorporates, but are not expressly part of, the Feedback, such as enabling technologies). Publisher will not disclose Customer's identity or Customer Data in connection with its use of Feedback.

DEPLOYMENT ARCHITECTURE; PROVIDER ACCESS; CUSTOMER RESPONSIBILITIES

2.1 Deployment architecture. The Platform deploys exclusively within the Customer Tenant. Publisher does not operate a shared infrastructure plane, multi-tenant SaaS backend, or cross-tenant data pipeline through which Customer Data transits. All Platform microservices, data stores, key management, and AI inference run within the Customer Tenant. The Platform web portal presents a sign-in endpoint authenticated through Customer's Microsoft Entra ID (or Customer's designated identity provider); no Customer Data is accessible without successful authentication and authorization against Customer's directory. All other Platform services are configured with private endpoints and expose no public internet endpoint. Service-to-service authentication uses managed identities bound to the Customer Tenant; Publisher holds no shared secrets or credential stores for Customer environments. AI inference executes on Azure OpenAI Service or other AI endpoints of Customer's choosing, deployed within the Customer Tenant; Publisher has no access to AI prompts, completions, or evidence artifacts generated during inference. Platform telemetry and diagnostic data are retained within the Customer Tenant unless Customer expressly authorizes transmission to Publisher for support purposes.
2.2 Publisher access. As the managed application publisher, Publisher holds least-privilege access to the Managed Resource Group through the authorization model declared in the managed application definition, scoped to a designated Publisher service principal or Microsoft Entra group and a specific Azure role definition. This access is confined to the Managed Resource Group and the resources Publisher deploys and operates within it; it does not extend to the broader Customer Tenant, to subscriptions or resource groups outside the managed application, or to Customer workloads Publisher did not deploy. Publisher exercises this access solely to deploy, configure, update, monitor, and support the Platform. Customer Data at rest is protected with customer-managed keys held in a Key Vault under Customer's control, so that control-plane access to the Managed Resource Group does not confer the ability to read or decrypt Customer Data. Customer may revoke Publisher's access by removing or modifying the managed application, with the understanding that doing so suspends Publisher's ability to support and maintain the Platform.
2.3 Customer responsibilities and Azure costs. Customer is responsible for: (a) providing an Azure subscription with sufficient quota, permissions, and budget for the resources defined in the deployment template; (b) all Azure infrastructure consumption charges incurred in the Customer Tenant (compute, storage, networking, AI tokens, log analytics), which Microsoft bills to Customer directly and which are not included in Publisher's subscription fees; (c) maintaining appropriate licensing and permissions for all integrated Microsoft and third-party services; (d) the security of the Customer Tenant, including identity and access management, network controls, and endpoint security for devices used to access the Platform; and (e) configuring Azure region selections consistent with Customer's data residency requirements. Publisher makes no representation that third-party APIs will remain available or functionally equivalent across Platform versions, and makes no guarantee regarding actual Azure consumption costs.

PRIVACY AND DATA PROTECTION

3.1 Data sovereignty. Customer Data is generated, processed, and stored exclusively within the Customer Tenant in the Azure region(s) selected by Customer at deployment. Customer retains all right, title, and interest in and to Customer Data. Publisher shall not request, access, or direct Customer to transmit Customer Data to Publisher systems except in connection with authorized support activities under a Customer-initiated support ticket. Publisher shall not use Customer Data to train AI models, to develop competing products, or for any purpose other than providing services to Customer. No Customer Data is used in Publisher's development or testing environments.
3.2 EU Standard Contractual Clauses. To the extent applicable, the parties will abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention, and other processing of Personal Data from the European Economic Area and Switzerland. All transfers of Customer Data out of the European Union, European Economic Area, and Switzerland will be governed by the Standard Contractual Clauses, as designated by the European Commission, made available by the Publisher at the applicable URL for such terms or as otherwise communicated to Customer. The parties acknowledge that, by reason of the deployment architecture described in Section 2.1, Customer Data is not transferred to Publisher in the ordinary course of Platform operation.
3.3 Personal Data. Customer consents to the processing of Personal Data by Publisher and its Affiliates, and their respective agents and Subcontractors, as provided in this Agreement. Before providing Personal Data to Publisher, Customer will obtain all required consents from third parties (including Customer's contacts, partners, distributors, administrators, and employees) under applicable privacy and Data Protection Laws.
3.4 Processing of Personal Data; GDPR. To the extent Publisher is a processor or subprocessor of Personal Data subject to the GDPR, the Standard Contractual Clauses govern that processing and the parties also agree to the following terms in this subsection:
a. Processor and Controller Roles and Responsibilities. Customer and Publisher agree that Customer is the controller of Personal Data and Publisher is the processor of such data, except when (a) Customer acts as a processor of Personal Data, in which case Publisher is a subprocessor or (b) stated otherwise in any Offering-specific terms. Publisher will process Personal Data only on documented instructions from Customer. In any instance where the GDPR applies and Customer is a processor, Customer warrants to Publisher that Customer's instructions, including appointment of Publisher as a processor or subprocessor, have been authorized by the relevant controller.
b. Processing Details. The parties acknowledge and agree that: (i) the subject-matter of the processing is limited to Personal Data within the scope of the GDPR; (ii) the duration of the processing will be for the duration of the Customer's right to use the Offering and until all Personal Data is deleted or returned in accordance with Customer instructions or the terms of this Agreement; (iii) the nature and purpose of the processing will be to provide the Offering pursuant to this Agreement; (iv) the types of Personal Data processed by the Offering include those expressly identified in Article 4 of the GDPR; and (v) the categories of data subjects are Customer's representatives and end users, such as employees, contractors, collaborators, and customers, and other data subjects whose Personal Data is contained within any data made available to Publisher by Customer.
c. Data Subject Rights; Assistance with Requests. Publisher will make information available to Customer in a manner consistent with the functionality of the Offering and Publisher's role as a processor of Personal Data of data subjects and the ability to fulfill data subject requests to exercise their rights under the GDPR. Publisher will comply with reasonable requests by Customer to assist with Customer's response to such a data subject request. If Publisher receives a request from Customer's data subject to exercise one or more of its rights under the GDPR in connection with an Offering for which Publisher is a data processor or subprocessor, Publisher will redirect the data subject to make its request directly to Customer. Customer will be responsible for responding to any such request including, where necessary, by using the functionality of the Offering.
d. Use of Subprocessors. Customer consents to Publisher using the subprocessors listed at the applicable Publisher URL or as otherwise communicated to Customer. Publisher remains responsible for its subprocessors' compliance with the obligations herein. Publisher may update its list of subprocessors from time to time, by providing Customer at least 14 days notice before providing any new subprocessor with access to Personal Data. If Customer does not approve of any such changes, Customer may terminate any subscription for the affected Offering without penalty by providing, prior to expiration of the notice period, written notice of termination that includes an explanation of the grounds for non-approval. Publisher shall not grant subcontractors access to the Customer Tenant without Customer's prior written approval and compliance with Section 2.2.
e. Records of Processing Activities. Publisher will maintain all records required by Article 30(2) of the GDPR and, to the extent applicable to the processing of Personal Data on behalf of Customer, make them available to Customer upon request.
3.5 Security. Publisher will take appropriate security measures that are required by Data Protection Laws and in accordance with good industry practice relating to data security. Publisher will notify Customer without undue delay, and in any event within seventy-two (72) hours, upon becoming aware of a security incident affecting Publisher-controlled components of the Platform. Customer is independently responsible for managing security incidents within the Customer Tenant under its own incident response plan.
3.6 Support Data. Publisher may collect and use Support Data internally to provide technical support for the Offering. Publisher will not use Support Data for any other purpose unless otherwise agreed in writing by the parties.

CONFIDENTIALITY

4.1 Non-Disclosure Agreement. The parties will treat all confidential information exchanged between the parties under this Agreement in accordance with the separate nondisclosure agreement ("NDA") executed by the parties. If no separate NDA is in effect, the following provisions apply to the parties' exchange of confidential information.
4.2 Confidential Information. "Confidential Information" is non-public information that is designated "confidential" or that a reasonable person should understand is confidential, including, but not limited to, Customer Data, Support Data, the terms of this Agreement, and Customer's account authentication credentials. Confidential Information does not include information that: (1) becomes publicly available without a breach of a confidentiality obligation; (2) the receiving party received lawfully from another source without a confidentiality obligation; (3) is independently developed; or (4) is a comment or suggestion volunteered about the other party's business, products, or services.
4.3 Protection of Confidential Information. Each party will take reasonable steps to protect the other's Confidential Information and will use the other party's Confidential Information only for purposes of the parties' business relationship. Neither party will disclose Confidential Information to third parties, except to its Representatives, and then only on a need-to-know basis under nondisclosure obligations at least as protective as this Agreement. Each party remains responsible for the use of Confidential Information by its Representatives and, in the event of discovery of any unauthorized use or disclosure, must promptly notify the other party. Publisher will not publish identifying information about Customer's compliance posture, framework status, or risk profile without Customer's express written consent.
4.4 Disclosure required by law. A party may disclose the other's Confidential Information if required by law, but only after it notifies the other party (if legally permissible) to enable the other party to seek a protective order.
4.5 Duration of Confidentiality obligation. These obligations apply: (1) for Customer Data, until it is deleted by Publisher or, where Customer Data resides solely in the Customer Tenant, for so long as Publisher has any access to it; and (2) for all other Confidential Information, for a period of five years after a party receives the Confidential Information.

SERVICE LEVELS; UPDATES AND SUPPORT

5.1 Service level agreements. Publisher may offer further availability and support obligations for an Offering. Such service level agreement ("SLA") will be made available by the Publisher at the applicable URL for such SLA or as otherwise communicated to Customer. Response and resolution targets are not guaranteed service levels unless expressly specified in an Order with a service level addendum.
5.2 Availability. Because the Platform runs within the Customer Tenant, availability is primarily a function of Azure service availability for Customer's subscription and region. Publisher's software components target ninety-nine percent (99%) availability for application layers under Publisher's control, excluding planned maintenance windows notified seventy-two (72) hours in advance, Customer Tenant outages, Azure service disruptions, and Customer-caused configuration changes.
5.3 Updates. Publisher releases Platform updates on a rolling schedule. Major updates, including new framework activations, module releases, and breaking API changes, are released with no less than thirty (30) days' advance notice and are subject to Customer acceptance testing in a staging environment prior to production deployment, at Customer's election. Customer may defer major updates for up to sixty (60) days in consultation with Publisher.
5.4 Support. Support Services are provided at the level associated with the purchased plan, covering Platform functionality, integration configuration guidance, evidence and control mapping questions within supported frameworks, and Platform-generated errors. Support excludes customization of Platform source code, troubleshooting of Customer Tenant infrastructure not deployed by Publisher, and consulting or advisory services beyond reasonable product guidance. Professional services, implementation services, and managed services are not included in the Platform subscription and, if purchased, are governed by a separately executed statement of work between Publisher and Customer.

VERIFYING COMPLIANCE

6.1 Customer must keep records relating to Offerings it and its Affiliates use or distribute. At Publisher's expense, Publisher may verify Customer's and its Affiliates' compliance with this Agreement by directing an independent auditor (under nondisclosure obligations) to conduct an audit or ask Customer to complete a self-audit process. Customer must promptly provide any information and documents that Publisher or the auditor reasonably requests related to the verification and access to systems running the Offerings. If verification or self-audit reveals any unlicensed use, Customer must order sufficient licenses to cover the period of its unlicensed use. The audits may be conducted more frequently, if required by the party's auditors and/or regulators, of books and records related to this Agreement. The expenses for all such audit will be borne by the party conducting the audit. All information and reports related to the verification process will be Confidential Information and used solely to verify compliance.
6.2 Upon request, Publisher will make available to Customer all information necessary to conduct an audit and demonstrate compliance under GDPR provisions for the processing of Personal Data. Customer may request information through a security questionnaire or self-attestation.

REPRESENTATIONS AND WARRANTIES

7.1 Publisher continuously represents and warrants that:
a. it has full rights and authority to enter into, perform under, and grant the rights in, this Agreement;
b. its performance will not violate any agreement or obligation between it and any third party;
c. the Offering will substantially conform to the Documentation;
d. the Offering will not: (i) to the best of Publisher's knowledge, infringe or violate any third party patent, copyright, trademark, trade secret, or other proprietary right; or (ii) contain viruses or other malicious code that will degrade or infect any products, services, software, or Customer's network or systems; and
e. while performing under this Agreement, Publisher will comply with law, including Data Protection Laws and Anti-Corruption Laws, and will provide training to its employees regarding Anti-Corruption Laws.
7.2 AI features, human oversight, and compliance outcomes. The Platform includes artificial intelligence features whose advisory outputs are subject to human review and disposition within the Platform. AI-generated output is provided to assist qualified personnel and does not constitute legal, audit, accounting, or other professional advice. Customer is responsible for implementing human oversight of AI-assisted compliance determinations as required by its applicable regulatory obligations, including Article 14 of the EU AI Act where applicable. Publisher updates framework mappings as new versions are published by the applicable standards bodies, subject to reasonable lead time, and framework content may lag official publications. Publisher does not warrant that use of the Platform, standing alone, constitutes compliance with any framework, law, or standard, and does not represent or guarantee any certification, attestation, audit outcome, or regulatory approval. Achieving and maintaining compliance requires Customer's ongoing operation of controls, organizational processes, and governance practices beyond the scope of the Platform's technical capabilities.
7.3 Disclaimer. Except as expressly stated in this Agreement, the Offering is provided as is. To the maximum extent permitted by law, Publisher disclaims any and all other warranties (express, implied or statutory, or otherwise) including of merchantability or fitness for a particular purpose, whether arising by a course of dealing, usage or trade practice, or course of performance.

DEFENSE OF THIRD-PARTY CLAIMS

8.1 By Customer. Customer will defend Publisher and its Affiliates from and against any and all third party claims, actions, suits, proceedings arising from or related to Customer's or any authorized user's violation of this Agreement or user terms (a "Claim Against Publisher"), and will indemnify Publisher and its Affiliates for all reasonable attorney's fees incurred and damages and other costs finally awarded against Publisher or its Affiliates in connection with or as a result of, and for amounts paid by Publisher or its Affiliates under a settlement Customer approves of in connection with a Claim Against Publisher. Publisher must provide Customer with prompt written notice of any Claims Against Publisher and allow Customer the right to assume the exclusive defense and control of the claim and cooperate with any reasonable requests assisting Customer's defense and settlement of such matter.
8.2 By Publisher. Publisher will defend Customer from and against any and all third party claims, actions, suits, proceedings, and demands alleging that: (i) the use of the Offering as permitted under this Agreement infringes or misappropriates a third party's intellectual property rights and (ii) any violation of applicable law including Data Protection Laws (a "Claim Against Customer"), and will indemnify Customer for all reasonable attorney's fees incurred and damages and other costs finally awarded against Customer in connection with or as a result of, and for amounts paid by Customer under a settlement Publisher approves of in connection with a Claim Against Customer; provided, however, that the Publisher has no liability if a Claim Against Customer arises from: (1) Customer Data or non-Publisher products, including third-party software; and (2) any modification, combination or development of the Offering that is not performed or authorized in writing by Publisher, including in the use of any application programming interface (API). Customer must provide Publisher with prompt written notice of any Claim Against Customer and allow Publisher the right to assume the exclusive defense and control and cooperate with any reasonable requests assisting Publisher's defense and settlement of such matter. This section states Publisher's sole liability with respect to, and Customer's exclusive remedy against Publisher for, any Claim Against Customer.
8.3 Notwithstanding anything contained in the above subsections, (1) an indemnified party will always be free to choose its own counsel if it pays for the cost of such counsel; and (2) no settlement may be entered into by an indemnifying party, without the express written consent of the indemnified parties (such consent not to be unreasonably withheld), if: (A) the third party asserting the claim is a government agency; (B) the settlement arguably involves the making of admissions by the indemnified parties; (C) the settlement does not include a full release of liability for the indemnified parties; or (D) the settlement includes terms other than a full release of liability for the indemnified parties and the payment of money.

PRICING, PAYMENT, SUBSCRIPTION TERM, AND RENEWAL

9.1 Invoicing. Microsoft will invoice and charge Customer under the terms of the Microsoft Commercial Marketplace Terms of Use and applicable Order. Subscription fees are billed annually in advance through Microsoft's Marketplace billing system and, where applicable, are eligible for decrement against Customer's Microsoft Azure Consumption Commitment. Publisher's obligations under this Agreement apply regardless of billing channel.
9.2 Subscription term and renewal. Each subscription begins on the Deployment Date or the date specified in the applicable Order and continues for an initial term of twelve (12) months unless the Order states otherwise. Unless either party provides written notice of non-renewal at least sixty (60) days prior to the end of the then-current term, subscriptions renew automatically for successive one-year terms at Publisher's then-current fees. Renewal fee increases shall not exceed twenty percent (20%) of the prior year's fees unless resulting from a material change in scope, additional framework activations, or material increases in Publisher's cost of goods.

TERM AND TERMINATION

10.1 Term. This Agreement is effective until terminated by a party, as described below. The term for each Order will be set forth therein.
10.2 Termination without cause. Unless otherwise set forth in an Order, either party may terminate this Agreement or any Order without cause on 60 days' notice. Termination without cause will not affect Customer's perpetual licenses, and licenses granted on a subscription basis will continue for the duration of the subscription period(s), subject to the terms of this Agreement. Publisher will not provide refunds or credits for any partial subscription period(s) if the Agreement or an Order is terminated without cause.
10.3 Termination for cause. Without limiting other remedies it may have, either party may terminate this Agreement or any Order immediately on notice if (i) the other party materially breaches the Agreement or an Order, and fails to cure the breach within 30 days after receipt of notice of the breach; or (ii) the other party becomes Insolvent. Upon such termination, the following will apply:
a. All licenses granted under this Agreement will terminate immediately except for fully-paid, perpetual licenses.
b. All amounts due under any unpaid invoices will become due and payable immediately. For metered Offerings billed periodically based on usage, Customer must immediately pay for unpaid usage as of the termination date.
c. If Publisher is in breach, Customer will receive a credit for any subscription fees, including amounts paid in advance for unused consumption for any usage period after the termination date.
10.4 Suspension. Publisher may suspend use of the Offering without terminating this Agreement during any period of material breach. Publisher will give Customer reasonable notice before suspending the Offering. Suspension will only be to the extent reasonably necessary. Suspension of license validation for non-payment does not delete the Managed Resource Group or Customer Data.
10.5 Refund. For Offerings ordered on a subscription basis that are $100,000 or more, if Publisher breaches any of the foregoing warranties and those breaches remain uncured for 30 days, Customer may terminate this Agreement and Publisher will provide Customer a full refund of all fees paid to Publisher.
10.6 Effect of termination on Customer Data. Upon expiration or termination, Customer's right to access and use the Platform ends, and Customer shall cease use of the Platform and delete or return Publisher's Confidential Information. Customer Data remains within the Customer Tenant and is not deleted by Publisher; Customer retains full control over Customer Data and may delete the managed application and Managed Resource Group at its discretion. For ninety (90) days following termination, Publisher will, upon request and at Publisher's then-current professional services rates, provide reasonable assistance exporting Customer Data from Platform-specific data structures into standard formats (JSON, CSV, PDF evidence packages); thereafter Publisher has no obligation to support such export. Customer Data stored in native Azure services persists according to the lifecycle policies Customer configures within the Customer Tenant.
10.7 Survival. The terms of this Agreement, including the applicable Order, that are likely to require performance, or have application to events that may occur, after the termination or expiration of this Agreement or any Order, will survive termination or expiration, including Sections 2.2, 3, 4, 7.2, 12, and all indemnity obligations and procedures.

EXPORT AND GOVERNMENT USE

The Platform and Documentation may be subject to US export control laws, including the EAR and ITAR. Customer shall not use, export, re-export, or transfer the Platform in violation of applicable export laws and is solely responsible for identifying whether its use of the Platform for CMMC, FedRAMP, or DoD-related workloads imposes additional export control requirements. If Customer is a government entity or government contractor, additional terms may apply under a separately executed Order. By accepting this Agreement, Customer represents and warrants that: (1) it has complied and will comply with all applicable government procurement laws and regulations; (2) it is authorized to enter into this Agreement; and (3) this Agreement satisfies all applicable procurement requirements.

INTELLECTUAL PROPERTY AND THIRD-PARTY COMPONENTS

12.1 Publisher IP. Publisher and its licensors retain all right, title, and interest in and to the Platform and Documentation, including the Platform's AI models, knowledge graph schemas, control crosswalk mappings, control libraries, evidence collection frameworks, and agent architectures, and all intellectual property rights therein, including rights under pending patent applications, regardless of whether improvements are developed in connection with services provided to Customer.
12.2 Third-party and open-source components. The Platform incorporates third-party and open-source components that are licensed under, and remain subject to, their own terms, including without limitation:
(a) Prowler, an open-source cloud security tool used to power the Platform's Security Scanner module, licensed under the Apache License, Version 2.0. The source repository is available at https://github.com/prowler-cloud/prowler, and a copy of the Apache License, Version 2.0 is available at https://www.apache.org/licenses/LICENSE-2.0.
(b) The Secure Controls Framework (SCF), published by the Secure Controls Framework Council, LLC, which provides the meta-framework control content underlying the Platform's control libraries and crosswalk mappings. SCF content is used under and remains subject to the SCF's license terms, available at https://securecontrolsframework.com.
A complete list of third-party and open-source components, together with their applicable license texts and required attributions, is set forth in the Platform's third-party notices, available within the Documentation. Third-party components are provided under their respective licenses and not under the license granted for the Platform; nothing in this Agreement limits Customer's rights under, or grants Customer rights beyond, those third-party licenses. Framework content referenced by the Platform, and all framework and standards names, are the property of their respective owners, and no affiliation with or endorsement by any standards body or licensor is implied.

MISCELLANEOUS

13.1 Entire Agreement. This Agreement supersedes all prior and contemporaneous communications, whether written or oral, regarding the subject matter covered in this Agreement. If there is a conflict between any parts of this Agreement, the order of precedence set forth in the preamble will apply.
13.2 Independent contractors. The parties are independent contractors. Customer and Publisher each may develop products independently without using the other's Confidential Information.
13.3 Agreement not exclusive. Customer is free to enter into agreements to license, use, and promote the services of others.
13.4 Amendments. Unless otherwise agreed in a writing signed by both parties, Publisher will not change the terms of this Agreement, including privacy terms, during the term of this Agreement.
13.5 Assignment. Either party may assign this Agreement to an Affiliate, but it must notify the other party in writing of the assignment. Customer consents to the assignment to an Affiliate or third party, without prior notice, of any rights Publisher may have under this Agreement to receive payment and enforce Customer's payment obligations, and all assignees may further assign such rights without further consent. Furthermore, either party may assign this Agreement without the consent of the other party in connection with a merger, reorganization, acquisition, or other transfer of all or substantially all of such party's assets. Any other proposed assignment of this Agreement must be approved by the non-assigning party in writing. Assignment will not relieve the assigning party of its obligations under the assigned Agreement. Any attempted assignment without required approval will be void.
13.6 Subcontractors. Publisher may engage subcontractors in the development and maintenance of the Platform and remains responsible for their performance and compliance with applicable obligations under this Agreement. Publisher shall not grant subcontractors access to the Customer Tenant without Customer's prior written approval and compliance with Section 2.2.
13.7 Trademarks. Neither party may use the other's trademarks, service marks, or trade names without prior written consent.
13.8 Severability. If any part of this Agreement is held to be unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, and the rest of the Agreement will remain in full force and effect.
13.9 Waiver. Failure to enforce any provision of this Agreement will not constitute a waiver. Any waiver must be in writing and signed by the waiving party.
13.10 No third-party beneficiaries. This Agreement does not create any third-party beneficiary rights except as expressly provided by its terms.
13.11 Notices. Notices must be in writing and will be treated as delivered on the date received at the address, date shown on the return receipt, email transmission date, or date on the courier or fax confirmation of delivery. Notices to Publisher must be sent to the address stated in the Order. Notices to Customer will be sent to the individual at the address Customer identifies on its account as its contact for notices. Publisher may send notices and other information to Customer by email or other electronic form.
13.12 Applicable law.
a. United States and Canada. If you acquired the Offering in the United States or Canada, the laws of the state or province where you live (or, if a business, where your principal place of business is located) govern the interpretation of these terms, claims for breach of them, and all other claims (including consumer protection, unfair competition, and tort claims), regardless of conflict of law principles.
b. Outside the United States and Canada. If you acquired the Offering in any other country, the laws of that country apply.
13.13 Compliance with laws. Publisher will comply with all laws and regulations applicable to its provision of the Offerings. Publisher will obtain and maintain any approvals, licenses, filings, or registrations necessary to its performance, and will comply with all law (including law related to export, corruption, money laundering, or any combination of these). Customer must also comply with laws applicable to their use of the Offerings.
13.14 Construction. Neither party has entered this Agreement in reliance on anything not contained or incorporated in it. This Agreement is in English only. Any translation of this Agreement into another language is for reference only and without legal effect. If a court of competent jurisdiction finds any term of the Agreement unenforceable, the Agreement will be deemed modified as necessary to make it enforceable, and the rest of the Agreement will be fully enforced to affect the parties' intent. Lists of examples following "including", "e.g.", "for example", or the like are interpreted to include "without limitation," unless qualified by words such as "only" or "solely." This Agreement will be interpreted according to its plain meaning without presuming that it should favor either party. Unless stated or context requires otherwise: (a) all internal references are to this Agreement and its parties; (b) all monetary amounts are expressed and, if applicable, payable, in U.S. dollars; (c) URLs are understood to also refer to successors, localizations, and information or resources linked from within websites at those URLs; (d) a party's choices under this Agreement are in its sole discretion, subject to any implied duty of good faith; (e) "written" or "in writing" means a paper document only, except where email is expressly authorized; (f) "days" means calendar days; (g) "may" means that the applicable party has a right, but not a concomitant duty; (h) "partner," if used in this Agreement or related documents, is used in its common, marketing sense and does not imply a partnership; (i) "current" or "currently" means "as of the Effective Date" but "then-current" means the present time when the applicable right is exercised or performance rendered or measured; (j) "notify" means to give notice under subsection 13.11; and (k) a writing is "signed" when it has been hand-signed (i.e., with a pen) or signed via an electronic signature service by a duly authorized representative of the signing party.

DEFINITIONS

"Affiliate" means any legal entity that controls, is controlled by, or is under common control with a party.
"Anti-Corruption Laws" means all laws against fraud, bribery, corruption, inaccurate books and records, inadequate internal controls, money-laundering, and illegal software, including the U.S. Foreign Corrupt Practices Act.
"Authorized Users" means Customer's employees and contractors authorized by Customer to use the Platform.
"Control" means ownership of more than a 50% interest of voting securities in an entity or the power to direct the management and policies of an entity.
"Confidential Information" is defined in the "Confidentiality" section.
"Customer Data" means all data ingested by, generated within, or stored by the Platform in the Customer Tenant, including security signals, compliance evidence, assessments, policies, and risk records, together with all data, including all text, sound, software, image or video files, that are provided to Publisher or its Affiliates by, or on behalf of, Customer and its Affiliates through use of the Offering. Customer Data does not include Support Data.
"Customer Tenant" means the Microsoft Azure subscription and Microsoft Entra ID tenant owned and controlled by Customer into which the Platform is deployed.
"Data Protection Law" means any law applicable to Publisher or Customer, relating to data security, data protection and/or privacy, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing of personal data and the free movement of that data ("GDPR"), and any implementing, derivative or related legislation, rule, regulation, and regulatory guidance, as amended, extended, repealed and replaced, or re-enacted.
"Deployment Date" means the date the Managed Application deployment completes successfully in the Customer Tenant, as evidenced by the deployment success notification, or the date specified in the applicable Order.
"Documentation" means all user manuals, handbooks, training material, requirements, and other written or electronic materials Publisher makes available for, or that result from use of, the Offering.
"End User" means any person Customer permits to use an Offering or access Customer Data.
"Feedback" means ideas, suggestions, comments, input, or know-how, in any form, that one party provides to the other in relation to recipient's Confidential Information, products, or services. Feedback does not include sales forecasts, future release schedules, marketing plans, financial results, and high-level plans (e.g., feature lists) for future products.
"Insolvent" means admitting in writing the inability to pay debts as they mature; making a general assignment for the benefit of creditors; suffering or permitting the appointment of a trustee or receiver for all or any of its (i.e., the non-terminating party's) assets, unless such appointment is vacated or dismissed within 60 days from the date of appointment; filing (or having filed) any petition as a debtor under any provision of law relating to insolvency, unless such petition and all related proceedings are dismissed within 60 days of such filing; being adjudicated insolvent or bankrupt; having wound up or liquidated; or ceasing to carry on business.
"Managed Resource Group" means the Azure resource group provisioned in the Customer Tenant by the Managed Application deployment.
"Offering" means all services, websites (including hosting), solutions, platforms, and products identified in an Order and that Publisher makes available under or in relation to this Agreement, including the software, equipment, technology, and services necessary for Publisher to provide the foregoing, and includes the Platform. Offering availability may vary by region.
"Order" means an ordering document used to transact the Offering via the Marketplace.
"Personal Data" means any information relating to an identified or identifiable natural person.
"Platform" means the Kyūdō AI-GRC software application, including its Compliance Graph, control assessment engine, AI copilot, policy, evidence, risk, vendor risk, security scanner, and trust center modules, deployed as an Azure Managed Application.
"Representatives" means a party's employees, Affiliates, contractors, advisors and consultants.
"Standard Contractual Clauses" means the standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the GDPR.
"Subcontractor" means any third party: (1) to whom Publisher delegates its obligations under this Agreement, including a Publisher Affiliate not contracting directly with Customer through an Order; or (2) who, in performing under a contract between it and Publisher or a Publisher Affiliate, stores, collects, transfers or otherwise processes Personal Data (obtained or accessed in connection with performing under this Agreement) or other Customer Confidential Information.
"Support Data" means all data, including all text, sound, video, image files, or software, that are provided to Publisher by or on behalf of Customer (or that Customer authorizes Publisher to obtain from an Offering) through an engagement with Publisher to obtain technical support for the Offering covered under this Agreement.
"Use" means to copy, download, install, run, access, display, use or otherwise interact with.